Some sophisticated computer attacks first target security systems of a network. Once the security system is incapacitated, an attacker can strike other components of the network that are now less defended or undefended altogether. In a network environment, a network traffic monitoring system can detect attacks on network components and perform responsive measures. The network traffic monitoring system itself might also be the victim of attacks, such as a precursor to an attack against a network component. For example, sensors that gather network data might be incapacitated such that the network traffic monitoring system cannot detect data flows that pass between the network components that the sensors are designed to monitor. Without the sensor data, the network traffic monitoring system may be unaware that the network is being subject to an attack. As another example, the network traffic monitoring system may include a component such as an analytics module for analyzing the sensor data. An attack may incapacitate the analytics module such that the module is unable to effectively analyze the incoming data or provide false analysis.